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Editor's Note: John Brennan was 
named director of the Terrorist 
Threat Integration Center (TTIC) 
on 12 March 2003. After joining 
the Central Intelligence Agency in 
1980, he served in a variety of 
analytic and management posi- 
tions focusing primarily on the 
Middle East and terrorism. He 
was a daily intelligence briefer at 
the White House in the mid-1990 s 
(k)(1 y nen served as \ | 
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'Mr. Brennan is agradu- 



(b)(3)(c), 

University and 
earned an MA from the Univer- 
sity of Texas. (U) 



Mr. Brennan was interviewed on 
21 July 200 4 6;(b)(3)(c) ~ | 
~Jpf the Studies in Intelli- 



gence Editorial Board. Subse- 
quent to the interview, the TTIC 
director reflected on the recently 
proposed National Counterterror- 
ism Center, telling Studies; "I am 
a strong proponent of a National 
Counterterrorism Center, as it will 
build upon the concept of TTIC 
and allow further integration of 




US government counterterrorism 
capabilities. The design, mission, 
and responsibilities of such a cen- 
ter need to be carefully thought 
through, however, as we must find 
a construct that optimizes those 
capabilities without disrupting the 
very important and critical work 
that is underway throughout the 
government. The center's mission 
must be clearly defined and its 
structure well engineered if it is to 
realize its potential." (U) 

On 27 October, Mr. Brennan was 
appointed as the (interim) direc- 
tor of the National Counterter- 
rorism Center. He will continue to 
serve as the director of TTIC until 
its functions are absorbed by the 
new national center. (U) 

As with all Studies in Intelli- 
gence articles, the statements, 
assertions, and opinions 
expressed in this article are those 
of the interview participants 
alone and do not necessarily 
reflect official positions or views 
of any US government entity. (U) 



John, the Terrorist Threat Inte- 
gration Center was established in 
2003 by order of the president, 
and you've recently consolidated 

^(DH^HW \facility. Looking back, 
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w~h~at~are the criteria by which 
you, as the director, believe the 
effectiveness of TTIC should be 
assessed after its first year of 
existence? What should the cate- 
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gories on the report card be, and 
what kind of grades would you 
award the center against these 
criteria? (U) 

Well, I think that the report card 
would be diverse because TTIC 
has such diverse responsibilities. 
First of all, we were charged by 
the president to make sure that 
there is one place in the US gov- 
ernment that has access to all of 
the information that is available 
to the government that is related 
to the terrorist threat. And I 
think, looking back over the past 
year, we have been successful in 
terms of bringing all of those dif- 
ferent networks into TTIC. Right 
now, we have access to 26 net- 
works, classified and unclassi- 
fied, an unprecedented breadth of 
access within the US govern- 
ment on terrorism-related mat- 
ters. We are soon going to expand 
to 28 networks, so the first met- 
ric, I think, should be the extent 
of improved, shared access to 
information, and I think we get a 
pretty good grade there. And our 
grade should reflect positively on 
the partner agencies that have 
been willing to provide us this 
unfettered and unrestricted 
access. (U//FOUO) 

Secondly, it's not sufficient just to 
have access to all these net- 
works; you have to be able to 
take advantage and leverage that 
access. And so we are now mov- 
ing forward on having an inte- 
grated architecture within TTIC 
so that those networks can be 
brought together to enable us to 
conduct federated searches 
against them. By the end of this 
month, we will have, for the first 
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. time, databases from different 
networks pulled together so that 
we can do a federated search 
against them. Through the rest of 
the year, we are going to be add- 
ing networks onto that inte- 
grated architecture so that the 
analysts and others can do these 
federated searches, because a 
simultaneous search against 
multiple networks is much more 
powerful than sequential 
searches against individual net- 
works. So, since we are not there 
yet, I would give us a very tenta- 
tive grade there of "in progress;" 
we seem to be on track, we are 
not there yet, but we certainly 
have the design ready to go. (U) 

Another of our responsibilities is 
to make sure that we are able to 
disseminate information and 
analysis to all of the appropriate 
federal consumers. Here I think 
we get a pretty good grade; I'll 
give us something in the B-plus 
category. We now have two prin- 
cipal mechanisms to get informa- 
tion out electronically, which I 
think really is the way we need to 
go as far as making s ure there's 
timel y dissemination. I 

(b)(l ) 

(b)(3)(c) 
(b)(3)(n) 
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One of the areas that we are still 
"growing" is actually doing the 
analysis. We have, quite hon- 
estly, precious few analysts; there 
are a couple dozen analysts who 
are doing all-source analysis. And 
we are really looking forward to 
additional analysts coming in 
from our partner agencies. We do 
a good job as far as reportorial 
coverage, but as far as the in- 
depth, strategic pieces that really 
provide insights and understand- 
ing to the customers about the 
nature of the terrorist threat, 
we're not there yet. (S//NF) 
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That's a good segue for discussing 
the challenges you face regarding 
staffing and subject matter exper- 
tise. With respect to the infusion of 
new analysts that you are receiv- 
ing into TTIC from various 
agencies, what portion of them 
arrives with subject matter exper- 
tise on terrorism'? Are most 
expected to learn on the job, and do 
you envision a training program of 
sorts in TTIC to supplement on- 
the-job training 1 ? (U) 

Well it's a little bit of all of the 
above. Most of the analysts who 
come to TTIC have some estab- 
lished area of expertise. Some- 
times it's in the terrorism area, 
and sometimes it's in areas that 
are very much related to terror- 
ism. They could be analysts of 
those countries that play an 
important role in terrorism. They 
may come with background 
related to potential targets of ter- 
rorist attacks. So they have rele- 
vant experience. What we are 
trying to do here in TTIC is to 
develop a whole analytic cadre of 
different backgrounds and exper- 
tise so we can leverage their 
expertise. (U//POUO) 

We have to develop our own train- 
ing programs and training 
classes, but we are really looking 
to those partner agencies to pro- 
vide analysts who are already 
trained in intelligence and have a 
background in terrorism. We rec- 
ognize that a lot of these agencies 
are strapped as far as the num- 
ber of qualified officers and ana- 
lysts they have available, but over 
time, I think we are going to be 
getting more and more individu- 
als with the requisite background 
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in intelligence and substantive 
expertise. (U//FOUO) 

How do you incentivize these 
assignments and ensure that you 
get the quality of people that you 
need over time? Do you envision, 
for example, a terrorist -related 
intelligence challenge so endur- 
ing that we ought to develop a 
professional cadre for the Intelli- 
gence Community of terrorism 
analysts, perhaps even with a sep- 
arate career service? (U) 

Well, a couple of points there. 
First of all, everyone who comes 
here is an assignee from his or 
her home agency, not a detailee. 
That's an important distinction 
because they bring with them 
their authorities from their 
parent organization. I believe 
that the terrorism threat to US 
interests is going to be an endur- 
ing one, and we need to have a 
sustained and very robust capa- 
bility in the terrorism arena in 
order to deal with it. I think that 
TTIC is the first step toward 
having a real collaborative and 
integrated environment for ana- 
lysts. And if we are going to do it 
well, we really are going to have 
to make some adjustments as far 
as the Intelligence Community's 
personnel system. We need to 
make sure there is recognition 
that service within TTIC is 
looked upon as a career enhanc- 



ing assignment, just as a tour of 
duty in a "joint assignment" is 
seen as a prestige factor for 
career development in the mili- 
tary. We are right now complet- 
ing the negotiation of MOAs 
with all of the partner agencies 
regarding what the personnel 
obligations are. These will 
include commitments from those 
agencies that service in TTIC 
will be appropriately recognized 
and that those individuals will 
serve in TTIC for a minimum of 
two years. (U//FOUO) 

Are we moving toward a time 
when "counter terror ism analysts" 
will represent a distinct profes- 
sional career track, analogous to 
economic analysts, political ana- 
lysts, and military analysts? (U) 

I think terrorism analysis is 
rather unique and really requires 
some well-developed skills. And 
so I very much see it as a dis- 
tinct discipline within the intelli- 
gence arena. I believe that an 
analyst can serve his or her 
entire career working on terror- 
ism. I would encourage them, as I 
would any analyst, to spend time 
outside of their specific field of 
interest, because it really helps 
to put their area of expertise in 
some kind of context and per- 
spective. But I fully expect that 
younger analysts who are either 
in TTIC or in one of our partner 
agencies, if they're committed to 
being terrorism analysts, are 
going to find ample opportunity 
for a 20- or 30-year career to 
serve in support of specific and 
discrete missions related to ter- 
rorism. (U) 
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As an Intelligence Community, 
we need to think through what 
the career tracks should look like 
so that analysts have a variety of 
attractive options. They shouldn't 
see themselves as on a conveyor 
belt moving up within a single 
stovepipe. One of the great things 
about TTIC is that you have ana- 
lysts from the Secret Service, the 
Coast Guard, CIA, DIA, FBI, 
whatever, sitting next to each 
other and really understanding 
what other government organiza- 
tions do and seeing the impor- 
tance of terrorism analysis for 
those agencies and missions. This 
has opened up the horizons, not 
just in terms of what the require- 
ments are, but what the possibili- 
ties are as far as their 
involvement in some of these 
areas. So, for anybody who really 
wants a career on terrorism, 
there is going to be no dearth of 
opportunities and positions. (U) 

In recent discussions about 
intelligence transformation, a 
prominent theme is the need to 
break down old organizational 
barriers, promote horizontal 
integration, and intensify col- 
laboration. It's often said that 
one of the immediate challenges 
that goes along with this is 
understanding and minimizing 
the effects of "culture clash," 
when employees from a wide 
variety of organizations are 
brought together. What are your 
impressions of how that has 
worked? Has "culture clash" 
manifested itself in ways that 
were unexpected or require some 
work to overcome? (U) 



Within the walls of 
TTIC, there has been a 
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together of the 
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It's interesting. People ask how 
we have been able to deal with 
all these representatives from 
these different agencies being put 
in this cultural cauldron. To be 
quite frank, we never really had 
to work at trying to develop a 
TTIC culture. When you bring 
together analysts, information 
systems, and databases, and 
when you have a critically impor- 
tant mission, individuals quickly 
forget whether they are from CIA 
or DIA or Secret Service. They 
work together because the mis- 
sion is so important. What they 
are here to do is to understand 
the terrorist threat and to pre- 
vent future 9/1 Is. And so we 
found an immediate bonding 
among the analysts here. (U) 

Quite honestly, some clashes 
arise when we deal with some of 
the partner agencies, because 
some individuals look upon 
TTIC as a competitive organiza- 
tion. I think they need to view 
us as a part of them and they a 
part of us. But within the walls 
of TTIC here, we find that there 
has been a tremendous blending 
together of the different cul- 
tures in an enriching sense, 
because they better understand 
what the others' missions are. I 
think a lot of the cultural 
clashes that take place are the 



result of ignorance, because an 
analyst or an individual officer 
from one agency really doesn't 
understand or appreciate what 
the mission requirements are of 
another department or agency. If 
they become intimately familiar 
with those missions then they 
say, "Oh, I understand," and a 
lot of those barriers quickly 
break down. That's why I'm a 
strong proponent of an overhaul 
of the Intelligence Community, 
because we have grown up 
within stovepipes, which have 
been detrimental to the overall 
intent of the Intelligence Com- 
munity. (U) 

Do you regard TTIC's organiza- 
tion and practices as a model for 
the way Intelligence Community 
components should operate in the 
future? (U) 

TTIC is so new and innovative, 
and I really believe that it is the 
shape of things to come in the 
future. We should not still be 
operating in the 1947 mindset of 
capabilities-based organizations 
that pursue related objectives 
and initiatives separately. What 
we need to do is to make sure 
that we establish centers like 
TTIC, where the capabilities of 
CIA, DIA, and NSA, as well as of 
some of the newer players on the 
intelligence field — such as the 
Department of Homeland Secu- 
rity and the FBI — are fused 
together in an integrated envi- 
ronment. (U) 

That's why the concept of a 
Director of National Intelligence 
is an appealing one because it 
moves the Intelligence Commu- 
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nity away from being focused 
solely on "foreign intelligence," 
which has been the case for the 
past 55 years or so. Intelligence 
is more than foreign intelligence; 
it is domestic intelligence as well. 
And there really needs to be bet- 
ter orchestration of the overall 
intelligence effort across the com- 
munity. (U) 

Let me ask about analytic 
redundancy. There's a limited 
pool of experienced counterter- 
rorism analysts and so how 
they're concentrated and distrib- 
uted makes a difference. Given 
the limited talent pool, you've 
got to think carefully about how 
much competing analysis makes 
sense. And today, your mandate 
is shared in whole or in part by 
DHS's Information Analysis and 
Information Protection Director- 
ate, by FBI's Counterterrorism 
Division and Office of Intelli- 
gence, by OTA and CIA, and by 
DIA's Joint Intelligence Task 
Force-Counterterrorism (JITF- 
CT). Could you describe the 
types of analytic tasks uniquely 
performed at TTIC and explain 
how they differ from those being 
performed at other CT centers 
around town? (U) 

Well, there are a couple of issues 
here. First of all, with the 
standup of the Department of 
Homeland Security and with the 
Office of Intelligence of the FBI, 
there was strong interest in the 
White House and elsewhere that 
we have the ability to integrate 
terrorism information and 
related analysis, so you don't 
have separate information and 




TTIC Headquarters. (U//FOUO) 

analysis streams going to senior 
officials and others. TTIC now 
has the responsibility to provide 
integrated assessments of the 
terrorist threat; for example, 
when there are Principals Com- 
mittee meetings or Deputies 
Committee meetings or the presi- 
dent needs to be briefed on some- 
thing about the terrorist threat, 
TTIC represents the views from 
throughout the community and 
provides an integrated, fused 
assessment identifying differing 
views within the community as 
appropriate. So that is sort of a 
unique responsibility that we 
have on behalf of those partner 
agencies. (U//FOUO) 

But getting to your point about 
competitive or redundant analy- 
sis, one of the real concerns that I 
have is that there needs to be 



better orchestration of the differ- 
ent analytic elements that exist 
within the federal government 
because as you point out, ana- 
lytic resources are finite. We can- 
not waste the time or talent of 
any analyst by doing unnecessar- 
ily redundant work. I still see 
unnecessary — and unhelpful — 
redundancy when there is a ter- 
rorist incident or threat, and a 
half a dozen or more analytic 
entities produce very similar 
products. When we do that, we 
are wasting those precious 
resources, because we are not 
covering the universe of terror- 
ism issues appropriately. TTIC 
has been trying to promote the 
idea of a national framework that 
has a rational allocation of 
responsibilities so we don't have 
that unnecessary duplication. 
Clearly, some redundancy and 
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alternative analysis is desir- 
able — indeed, essential — but 
there needs to be a common game 
plan and not just a free market 
analytic environment out there. 
(S//NF) 

At times, unfortunately, I would 
equate the situation to what hap- 
pens in soccer played by seven- 
year-olds: When the ball goes to 
one end of the field, all those lit- 
tle feet scurry to that side of the 
field, leaving the rest of the field 
unattended. We cannot afford to 
do that on terrorism analysis in 
the US government. We need 
thoughtful and intentional com- 
petitive analysis — not haphaz- 
ard redundancy. We need to 
make sure that every part of the 
field is covered 24 hours of the 
day, and that requires overall 
orchestration. In this manner, 
the "orchestrator" knows exactly 
what TTIC is doing, and what 
CIA, FBI, DHS, and others are 
doing, and he or she can make 
informed decisions about adjust- 
ing areas of analytic emphasis. 
(U) 

Your remarks suggest to me that 
TTIC should emerge as the US 
government's unquestioned, 
authoritative center of gravity for 
CT analysis. This would leave the 
important departmental intelli- 
gence components to focus on 
their unique responsibilities for 
packaging, presenting, and com- 
municating information in a way 
that is most responsive to their 
leadership. With such an arrange- 
ment, it becomes tougher to argue 
for maintaining a truly robust 
counterterrorism analytic capa- 
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bility in CIA's Office of Terrorism 
Analysis. (U) 

I agree with you completely on 
the need for the TTIC — or an 
eventual National Counterterror- 
ism Center — to be the "center of 
gravity" for terrorism analysis. 
That center of gravity you refer 
to, and I use that same term 
myself, is a place where the 
shared statutory responsibilities 
of those partner agencies can be 
fulfilled in an integrated, collabo- 
rative environment. And if you 
look at the statutory language 
that set up the CIA, and you look 
at the Homeland Security Act, 
and you look at other statutes 
and commissioning documents 
that have given these depart- 
ments and agencies responsibil- 
ity for assessing and analyzing 
the terrorist threat, you can 
understand why same types of 
things are being done in differ- 
ent places. Those statutory 
responsibilities, however, can be 
fulfilled in this collective joint 
venture known as TTIC on behalf 
of all those departments and 
agencies. (U) 

There are discreet mission 
responsibilities that can and 
must be fulfilled inside of those 
agencies themselves. For exam- 
ple, DHS has tremendous respon- 
sibility for understanding the 
vulnerabilities of the US home- 



land — what opportunities at the 
state or local level could terrorist 
groups take advantage of; what 
are the materials, the venues, the 
security weaknesses, and lapses? 
These are the things that DHS is 
uniquely able to address. But the 
task of analyzing the nature and 
scope of the threat that is com- 
ing from the terrorist groups 
need not be done in DHS as well 
as in TTIC. (U) 

Also, I think you need a place 
within the US government where 
there is truly an independent and 
neutral assessment of the terror- 
ist threat. Each of TTIC's part- 
ner agencies has a responsibility 
for actions related to the threat. 
DHS has responsibility for miti- 
gating the threat, putting in 
place defensive measures, and 
making the homeland a more dif- 
ficult place for terrorists to ply 
their trade, CIA has responsibil- 
ity for helping to neutralize the 
threat and for collecting against 
it. FBI, from the law enforce- 
ment perspective, has the respon- 
sibility to find individuals here in 
country and overseas who are 
threatening US interests. While 
these agencies need internal ana- 
lytic resources to guide their 
activities, operations, and inves- 
tigations, I would argue that the 
assessments of the threat posed 
by terrorist groups should be 
done primarily by TTIC and, 
eventually, by a National Coun- 
terrorism Center. (U) 

So would you then confine the 
role of departmental CT analysts 
and those in CTC to "direct sup- 
port" — for example, targeting 
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support to the Directorate of 
Operations? (U//FOUO) 

Not exactly. There are also ana- 
lytic responsibilities, I think, that 
need to remain within those indi- 
vidual agencies and depart- 
ments. CIA analysts for example, 
will need to track, understand, 
and analyze the root causes of 
terrorism. Also, they need to 
address the political, economic, 
and social consequences of terror- 
ism, as well as state sponsorship 
issues, and the counterterrorism 
policies and capabilities of for- 
eign governments. These are 
areas that are best addressed by 
the country and functional ana- 
lysts in CIA who have tremen- 
dous breadth and depth of 
experience on foreign intelli- 
gence issues. We shouldn't try to 
build that capability within TTIC 
when it already exists some- 
where else. CIA is uniquely qual- 
ified to do that. Likewise, DHS is 
uniquely qualified to be doing the 
analysis on homeland vulnerabil- 
ities, while FBI analysts are 
uniquely qualified to address 
purely domestic intelligence mat- 
ters. (U//FOUO) 

Within TTIC, you have an Infor- 
mation Sharing and Knowledge 
Development Department, includ- 
ing an element that's charged 
with Advanced Analytic Tech- 
niques and Red Teaming. Can 
you tell us a bit about the types of 
advanced analytic techniques 
being explored and considered 
and perhaps as well a word about 
how your red teaming activities 
are being developed and 
deployed? (UIIFOUO) 
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Well, it's one of the areas that we 
are still in the process of develop- 
ing, but let me talk a little bit 
about it conceptually. We have 
unprecedented access to all these 
networks and all these data- 
bases — terabytes upon terabytes 
of data — but there's absolutely no 
way that we could put eyes on 
every bit of information even if 
we had thousands of analysts 
here. What we really need to do 
in an environment like TTIC that 
has this type of access to data, is 
to apply robust analytic tools, the 
computing power that's out there, 
so that we can make the connec- 
tions between seemingly unre- 
lated bits and pieces of 
information. (U//FOUO) 

And there is tremendous ana- 
lytic tool capability and tremen- 
dous computing power available 
to do this. We're not doing "data 
mining," but we're applying the 
analytic tools for sophisticated 
search queries against those dif- 
ferent databases and informa- 
tion systems. And if you have 
individuals and databases from 
diverse organizations such as the 
Transportation Security Admin- 
istration, Coast Guard, Secret 
Service, FBI, CIA, and others, 
you can do queries in ways that 
traditionally have not been done 



in the foreign intelligence com- 
munity. So what we are trying to 
do is to match the expertise, the 
backgrounds, and the skill areas 
of the people in this team with 
databases, computing power, and 
analytic tools. If you bring that 
together, you are able to leverage 
the knowledge of the individuals, 
the capability of technology, and 
the existence of data. We are 
going to be seeing new ways of 
surfacing connections between 
those dots and creating new 
knowledge, and that's what we 
mean by know-ledge develop- 
ment. (U//FOUO) 

Another aspect of the analytic 
mission is guiding collection pri- 
orities and tasking. A coordinated 
US government strategy for col- 
lecting and exploiting intelligence 
across the domestic intelligence- 
foreign intelligence divide implies 
the need for an analytic center of 
gravity that directly supports and 
guides tasking. Can TTIC per- 
form that function today? (U) 

Well, right now TTIC is the mis- 
sion manager on terrorism for the 
community as far as the collec- 
tion requirement system is con- 
cerned. We do play a lead role; we 
work with the other agencies and 
departments to determine the 
national intelligence priorities 
framework for terrorism. As you 
know, there is a very well-devel- 
oped collection requirement sys- 
tem on foreign intelligence, and 
what we have been trying to do 
over the past year or so is to 
broaden that focus in the terror- 
ism world, so it's not just foreign 
intelligence. For example, right 
now we are dealing with the 
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threat to the homeland that al- 
Qa'ida poses, and so we've had a 
number of meetings where organi- 
zations that have focused tradi- 
tionally on foreign intelligence get 
together with those departments 
and agencies that are now respon- 
sible for domestic intelligence col- 
lection and dissemination. As the 
Intelligence Community evolves 
over the next year or two, we are 
going to see continued changes so 
that, for example, the National 
Intelligence Collection Board, 
which has had a foreign intelli- 
gence focus, is likely to expand to 
include domestic intelligence 
requirements. (U) 

Information acquired at the local 
level in the US could be of high 
value to TTIC. For example, the 
local police department in a large 
Midwest city has an ongoing sur- 
veillance program aimed at 
potential terrorists who are affili- 
ated with a local mosque. Some 
may be US citizens, others not. 
Local police have been monitor- 
ing their communications with 
other residents of the US sus- 
pected of terrorist ties. Can TTIC 
request or routinely receive a list 
of these names and the assess- 
ments or observations of that 
local police department, or are 
you receiving them now ? 
(U/ IFOUO) 

The FBI has the responsibility for 
working with local law enforce- 
ment as far as getting informa- 
tion that is relevant to the 
terrorist threat. The FBI, work- 
ing with its federal, state, and 
local partners on the Joint Terror- 
ism Task Force (JTTF), is putting 
in place a system that will facili- 
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tate the reporting and onward dis- 
semination of information 
acquired by local law enforce- 
ment to the broader counterter- 
rorism community. The FBI puts 
all that information into its data- 
bases and information systems, 
and TTIC has unfettered access to 
those FBI systems. (U//FOUO) 

So it's a "pull system," in effect, 
for TTIC. (U) 

Right, data do not have to be 
pushed to us by the FBI or by 
other organizations. That's the 
great thing about TTIC, we don't 
have to rely on CIA or FBI or oth- 
ers to package up information 
and send it to us. We have full 
real-time visibility into their 
information systems and data- 
bases. So anything that's commit- 
ted to an electron in the FBI 
system or the CIA system, we 
have real-time access to it. 
(U//FOUO) 

One of the most difficult chal- 
lenges has been access by others 
in the community to the data- 
bases of CIA's Directorate of 
Operations. The Homeland Secu- 
rity Act provides that DHS is to 
be given necessary and adequate 
accesses to all databases contain- 
ing covered information. To your 
knowledge, do the legacy IT archi- 
tectures, which are c 



mainly for vertical information 
flow, currently permit the kind of 
ready access to raw DO data by 
both TTIC and the Department of 
Homeland Security that's man- 
dated by law? (77/ IFOUO) 

Well, we at TTIC have full and 
unfettered access to DO informa- 
tion systems, DO cable traffic, 
and DO databases. DHS repre- 
sentatives here in TTIC have 
that type of access, so the obliga- 
tion on the part of CIA and FBI 
to make even the most sensitive 
information available to DHS is 
being met. A lot of that is being 
fulfilled through the TTIC con- 
struct, and other types of ave- 
nues of information sharing have 
been created over the past year. 
So, we feel good here about the 
visibility that TTIC and the part- 
ner agencies have into those 
information systems. Now what 
we have to do, as I mentioned 
earlier, is apply those analytic 
tools against the databases so 
that we are able to surface rele- 
vant information. (U//FOUO) 

If I understand correctly, you're 
saying it is the responsibility of 
DHS officers assigned to TTIC to 
determine whether data they have 
access to should be relayed to 
their colleagues back in their 
home agency of DHS. (U) 

It is correct up to a point. DHS 
analysts have visibility into the 
CIA and FBI databases and 
information systems, and if they 
see anything that is of relevance 
to the Department of Homeland 
Security that has not yet been 
formally disseminated, we have 
mechanisms in place that allow 



8 SECRET//NOFO(b)(3)(c) 



Studies in Intelligence Vol. 48, No. 4 



Approved for Release: 2014/09/03 C05618307 



Approved for Release: 2014/09/03 C05618307 

SECRET//NOFOR(b)(3)(c) 



that analyst to go back to CIA or 
the FBI and say, "you may not 
realize this, but this information 
is important. It must be dissemi- 
nated." We at TTIC do not dis- 
seminate raw intelligence. But it 
is our responsibility to make sure 
that if we identify something that 
is important, we then tell the 
originating agency, "You must get 
this out, you must disseminate 
this, it is important to others." 
(U) 

But we cannot allow individual 
officers to decide and then dis- 
seminate on their own what 
within that great mass of raw 
intelligence should go to other 
entities. It has to be done the 
right way; we take very seriously 
our obligations to protect sources 
and methods. We have been given 
visibility into the most sensitive 
information that the US govern- 
ment has available to it, and we 
have to make sure that we pro- 
tect sources and methods and do 
the right thing as far as sharing 
that information. (U) 

You've touched already on the dis- 
semination challenge and the 
important progress that's been 
made. Do TTIC responsibilities 
for dissemination of your prod- 
ucts stop at the national level 
now, deferring to DHS or the FBI 
for further dissemination to state 
and local officials under certain 
circumstances? (U) 

Correct. When TTIC was stood 
up, it was decided that we would 
disseminate information directly 
only to our federal partners. And 
so we share information with 
DHS, FBI, DOD, and others. 
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DHS has the statutory responsi- 
bility and the primary responsi- 
bility for sharing information 
with state and local officials as 
well as the private sector. The 
FBI has a statutory responsibil- 
ity to make sure that informa- 
tion is shared with law 
enforcement. So, what we do is 
provide information and analysis 
to DHS and FBI so that they can 
then share it as appropriate with 
their non-federal constituents. 
(U) 

This is part of the nascent 
national architecture for both 
horizontal and vertical informa- 
tion sharing. We need to be able 
to move information from the 
Top-Secret level of a federal 
department all the way to the 
Sensitive-But-Unclassified (SBU) 
level such that it is available to 
the cop on the street or the local 
mayor. But it has to be done in a 
coordinated and orchestrated 
fashion. What we don't want to 
do is to have everybody "shotgun- 
ning" information to all the dif- 
ferent constituencies. We have to 
recognize roles and responsibili- 
ties, and DHS has a certain 
responsibility for forwarding that 
information down vertically, as 
does the FBI. (U) 

Suppose TTIC prepares a classi- 
fied report on a likely foreign 



terrorist threat to a private oil 
refinery in Texas. DHS wants to 
alert the affected private sector 
persons. Who makes the decision 
regarding the scope and nature of 
what DHS or the FBI can dissem- 
inate further? Is that 
determination made by DHS, or 
must the "data owners" or origi- 
nator give prior approval? (U) 

I prefer the term "data stewards" 
to "data owners," because stew- 
ardship implies an obligation to 
fulfill the responsibilities of infor- 
mation sharing. Right now, to 
take your example, DHS would 
have to make sure that the data 
steward — for example, the CIA or 
FBI — is comfortable with the lan- 
guage being sent to a broader 
audience. In most cases today, 
there's no reason, from a techni- 
cal or policy perspective, that 
even sensitive information 
acquired by CIA's foreign intelli- 
gence collection should not flow 
expeditiously from the point of 
origin to TTIC, DHS, and FBI, as 
well as to non-federal entities. 
And if it has to go down to the 
governor or the mayor or the 
local police chief, you can shape 
the information at the point of 
origination or put it into a for- 
mat that is going to be usable at 
its endpoint that also protects 
sources and methods. (U) 

I would argue that CIA officers 
abroad need to send in a report 
that can be broken down auto- 
matically into two parts. One 
part contains the "who, what, 
where, when, and how" of an 
imminent terrorist attack, and 
that information goes quickly at 
the SBU level to all the appropri- 
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ate end users. The other part of 
the report that provides the clas- 
sified contextual information 
that's operationally sensitive and 
is not needed at the local level 
goes to a more restricted group of 
users. If the report has to go to 
the governor, mayor, or local 
police chief, there must be recog- 
nition at the point of origination 
that what's involved is the need 
to rapidly share actionable intel- 
ligence, and that means creating 
a format that makes information 
in the report "separable." (U) 

Right now, using your example, 
we see too many human inter- 
ventions: a report comes in; a 
request is made for a releasable 
tear-line; it's then put into tear- 
line format; then it goes out to a 
federal consumer set at a classi- 
fied level; and then that con- 
sumer will come back with a 
request to prepare it again at the 
SBU level for sharing with local 
law enforcement, and it has to go 
back to the originating agency to 
approve the language. There are 
too many steps here; it eats up 
time and resources. So we need to 
reengineer the system to make it 
more efficient from the get-go. 
That's why I emphasize so much 
the importance of coming to 
agreement on the overall busi- 
ness process architecture, to 
include greater clarity of infor- 
mation requirements based on 
agreed-upon roles and responsi- 
bilities. (U) 

Some of the analytic puzzles you 
work at the TTIC level may bene- 
fit from information first 
discovered by state or local 
authorities — for example, reports 
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of suspect behavior or casing 
activity at vulnerable sites. How 
well does the flow of information 
work in this direction, and who is 
responsible for ensuring local law 
enforcement knows what activi- 
ties or behavior may have 
intelligence significance at TTIC? 
(U) 

You are absolutely right. It needs 
to be a two-way flow, from locals 
coming up as well as from fed- 
eral officials going down, and all 
the way into the international 
environment. At this point, the 
FBI has the unique responsibil- 
ity of ensuring that local law 
enforcement is kept informed of 
the terrorist threat and is pro- 
vided requirements and informa- 
tion that will allow them to 
identify those things that are 
potentially terrorist related. DHS 
has a similar responsibility with 
respect to non-law enforcement 
officials at the state and local lev- 
els and leaders in the private sec- 
tor. This is the direction in which 
the whole national architecture is 
evolving. (U) 

It is a very complex "system of 
systems" for ensuring education, 
information flow, and product 
dissemination systems across 
multiple domains within the US. 
And then you expand it into the 
international context, because 
we're really talking about an 



international coalition against 
the terrorist threat. So it 
becomes an enormous challenge 
to integrate and knit together the 
different elements. Many have 
shared interests and responsibili- 
ties, but they frequently have 
very different mission responsi- 
bilities. This is obviously a 
daunting challenge and meeting 
it will take time. (U) 

Can you expand on the new chal- 
lenges in the international 
context, particularly as they affect 
traditional intelligence liaison 
activities? Within the Intelligence 
Community, there is increased 
emphasis on horizontal integra- 
tion to respond effectively. Liaison 
relationships, however, typically 
have been the province of verti- 
cally organized collection 
organizations. Can you, as the 
director of TTIC, interact seam- 
lessly and efficiently with 
counterparts in other countries 
without being impeded by busi- 
ness practices that grew up 
around older organizational 
arrangements? (U) 

Well, TTIC isn't trying to take 
over the liaison responsibilities of 
these individual agencies. CIA 
and FBI will always maintain 
close, robust relationships with 
sister services overseas. But inter- 
estingly, other TTIC-like organiza- 
tions are sprouting up worldwide. 
This reflects recognition that, 
with the very complexity of the 
challenge and the multitude of 
official entities involved in terror- 
ism, national governments need a 
"portal," a place where you can 
plug these elements and informa- 
tion systems together. And so we 
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have a very close relationship 
with our British counterpart, the 
Joint Terrorism Analysis Center. 
The Australians also have a 
TTIC-like structure, and other 
countries are moving down that 
road. The existence of these inte- 
grated, multi-agency national 
entities like TTIC makes for more 
effective international coopera- 
tion on terrorism than exclusive 
reliance on agency-to-agency con- 
nections. (U//FOUO) 

Given the level of scrutiny and 
evaluation the Intelligence Com- 
munity is receiving from so many 
quarters today, it is not surprising 
that radically different arrange- 
ments are being considered for 
managing and organizing intelli- 
gence. From the perspective of your 
unique mission, what would be 
the distinctive characteristics of a 
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transformed Intelligence Commu- 
nity? (U) 

First and foremost, I would say 
better integration of effort. This 
is the key to success. It involves 
harnessing the diverse capabili- 
ties from all elements of the US 
government and applying them 
in an integrated way against pri- 
ority national security issues. 
This will enhance both effective- 
ness and efficiency. A second 
desirable feature would be 
orchestration — clear leadership 
of a complex community. This is 



where the concept of a National 
Intelligence Director (NID) 
becomes attractive. It responds 
to the growing need for a well- 
coordinated effort, involving a 
vast array of capabilities applied 
against a very complex problem 
so that what emerges sounds 
more like a symphony than a 
cacophony. This orchestration of 
effort obviously is important not 
just for the foreign intelligence 
establishment, but extending to 
domestic intelligence as well. 
These are the main characteris- 
tics of the Intelligence Commu- 
nity I would like to see evolve. 
(U) 

John, thank you very much for 
your time today. (U) 
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